How to gain a shell?

Question

I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.

My question is this: I can create application that is guaranteed to be run by the other user. How can I use this to get shell access under their privileges/account?

It's less useful for me to just be able to run commands as them and more useful for me to actually be able to drop into a shell as them, because there's an application that verifies if I've succeeded in compromising the account properly, so I'd like to run that interactively.

The first thing that occurred to me was to spawn a netcat daemon and run my commands through that, but the -e option doesn't seem to exist on this compromised VM.

Thoughts/ideas? I've been racking my brains here for a while - and I know this is simple!

EDIT: I'm not looking for an answer/spoiler to the exercise I'm stuck on, but I feel there's a gap in the fundamental understanding I have of system security. I figure if I can't figure out how to exploit this hole, I'm missing some piece of information. I want that fundamental piece of information, not an answer to the actual problem I'm facing.

Answer 1

If you can create a process that will run as the victim user, you already have shell access under their privileges. Anything the victim can do, your program can do. So you've already won, you just haven't realized it yet!

(One simple example: Why do you need a shell? If there's something you want to do with the victim's privilegs, why don't you hard-code into your program what actions you want to do?)

If you really want to set up an interactive shell, that's doable too. I could tell you several ways to do it, but you said you don't want spoilers, so let me just try to give you some hints without answering it flat-out.

1. You mentioned that running netcat would be one way to achieve your goals, however the version of netcat installed on their system is out of date. If Alice wanted to install a program for her own use, could she? If you have access to Alice's account and can do anything Alice can do, does that give you any ideas?

2. How is netcat implemented, internally? How does it work? Could you do something like that yourself?

3. Let's say you've compromised Alice's account. What are some ways that Alice could log into her account? Sure, she could log in with her login password, but what else?

4. Is there anything Alice could do to give one of her friends the ability to log into her account, if she wanted? What are some ways she could do that? If you have the ability to do anything Alice can do, does that give you any ideas for something you could do to get access to her account?

5. If you run ls -a from some user's home directory, what do you see? What do those crazy files do? Does that give you any ideas?

Hopefully that's enough to get you thinking!

Answer 2

One way of gaining a shell as a user is to find a setuid executable running as that user. Ideally this executable is a shell, such as /bin/bash, in this case you would be dropped to a shell running as that user. If this isn't the case you can always corrupt the executable's memory at runtime using a buffer overflow. Having a setuid executable that is also globally writable will never happen in real file, but this is some unrealistic war game, so you never know.

Another option is to write to the /home/USER/.bashrc file, which could be globally writable or could be modified if you can execute a command as that user. This script will be executed by that user each time they login. If this user is a sudo'er then you can modify the .bashrc file to control the $PATH environment variable and trick the user into executing a fake sudo proxy executable to obtain root privileges.

Answer 3

The simplest way I've seen is to just build a simple executable that listens on a network port, and on connect forks off a copy of /bin/bash, assigning the network socket in and out as stdin/stdout for shell (see man dup2). Then when you connect, you're presented with a bash shell. It's about 10 to 20 lines of code or so, altogether.

This is the basic functionality behind netcat's -e option, which is generally disabled at compile time so that it can't be [as easily] used to aid security breaches.

In my experience, though, most hackers prefer to create their own custom "shell" in perl which has a specialized command set, authentication, and plenty of terrible english. Also, connecting to a private IRC server and listening for commands that way is very popular for reasons I don't think I have to explain.